# Inquiry About Quarantined Kibana Task Manager Index File

**URL:** <https://discuss.elastic.co/t/inquiry-about-quarantined-kibana-task-manager-index-file/388947>\
**Category:** Elasticsearch\
**Created:** [August 3, 2026, 2:02am UTC](https://discuss.elastic.co/t/inquiry-about-quarantined-kibana-task-manager-index-file/388947 "2026-08-03T02:02:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Frances\_Chu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frances_chu/32/127298_2.png) [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\
**Post date:** [August 3, 2026, 2:02am UTC](https://discuss.elastic.co/t/inquiry-about-quarantined-kibana-task-manager-index-file/388947/1 "2026-08-03T02:02:13Z")

</div>

We would like to raise a case regarding a quarantined file related to one of our Elasticsearch/Kibana indices.

While checking the index UUID, we found that it appears to be related to the following Kibana index

".kibana\_task\_manager\_8.11.4\_001": {  
"settings": {  
"index": {  
"uuid": "..."  
}  
}  
}

A file named below was detected as a suspected backdoor and has been quarantined

\_tmov0\_ES812Postings\_0.doc

Could you please help confirm the following?

1. What is the purpose of the file `_tmov0_ES812Postings_0.doc`?
2. Is this file part of the `.kibana_task_manager_8.11.4_001` index?
3. Is it safe to remove this file from quarantine, or should it be restored?
4. If the file remains missing or quarantined, will there be any impact on the Elasticsearch cluster or Kibana Task Manager functionality?
5. Are there any recommended checks we should perform to confirm the health and integrity of the related index?

---

<div class="post-metadata">

**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\
**Post date:** [August 3, 2026, 9:04am UTC](https://discuss.elastic.co/t/inquiry-about-quarantined-kibana-task-manager-index-file/388947/2 "2026-08-03T09:04:25Z")

</div>

This is answered by [this warning in the docs](https://www.elastic.co/docs/reference/elasticsearch/configuration-reference/path):

> Don’t modify anything within the data directory or run processes that might interfere with its contents. If something other than Elasticsearch modifies the contents of the data directory, then Elasticsearch may fail, reporting corruption or other data inconsistencies, or may appear to work correctly having silently lost some of your data. Don’t attempt to take filesystem backups of the data directory; there is no supported way to restore such a backup. Instead, use [Snapshot and restore](https://www.elastic.co/docs/deploy-manage/tools/snapshot-and-restore) to take backups safely. **Don’t run virus scanners on the data directory. A virus scanner can prevent Elasticsearch from working correctly and may modify the contents of the data directory. The data directory contains no executables so a virus scan will only find false positives.**

> [@Frances\_Chu](#):
>
> 1. If the file remains missing or quarantined, will there be any impact on the Elasticsearch cluster or Kibana Task Manager functionality?

Yes, modifying the contents of the data directory (e.g. by removing a file) is very harmful to Elasticsearch.